CVE-2026-111884
8.3HighPublished 17 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-308
Impact
Attackers with a hijacked or active session can permanently take over accounts, including superadmin, by resetting passwords via email. They only need access to a logged-in user's session on accounts without two-factor authentication enabled.
Root cause
The user control panel API endpoint for updating account email addresses validates only the session and CSRF token without requiring the user to re-enter their current password.
Affected systems
phpMyFAQ before 4.1.9, and 4.2.0-alpha before 4.2.0-beta
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Fix & remediation
Upgrade to phpMyFAQ 4.1.9 or 4.2.0-beta or later. As an immediate workaround, enforce two-factor authentication on all accounts to block password-reset account takeovers.
$ composer update phpmyfaq/phpmyfaqAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. An attacker with a hijacked session can set the e-mail to their own mailbox and use the password-reset flow to take over non-2FA accounts, including superadmin.